Verify any image
The point of these images is that you don't have to trust us. Every claim below is checkable from your terminal, no account required.
1 · Pull it (no login, no rate limit)
docker pull ghcr.io/rtvkiz/minimal-python:latest2 · Verify build provenance (SLSA L3)
Proves the image was produced by the workflow in the repo, at a specific commit, on a GitHub-hosted runner.
gh attestation verify oci://ghcr.io/rtvkiz/minimal-python:latest --owner rtvkiz3 · Inspect the SBOM
cosign verify-attestation --type spdxjson \
--certificate-identity-regexp='https://github.com/rtvkiz/minimal/' \
--certificate-oidc-issuer='https://token.actions.githubusercontent.com' \
ghcr.io/rtvkiz/minimal-python:latest \
| jq -r '.payload | @base64d | fromjson | .predicate' > python-sbom.spdx.jsonHow this compares
| Minimal | Chainguard | Docker Hardened | |
|---|---|---|---|
| License | MIT | Proprietary | Apache-2.0 |
| Cost | $0 | ~$30k/image/yr | Free + paid support |
| Auth to pull | No | Yes | Yes |
| Rate limits | None | Yes | Yes |
| Build recipes public | Yes | No | Yes |
| Cosign + SBOM + SLSA L3 | Yes | Yes | Yes |
Reach for Minimal if you want hardened images without paying or signing up, and want to read every build recipe. It's not the right fit if you need a vendor contract, FedRAMP/STIG paperwork, or thousands of images on day one.
More
Source, build recipes and security policy live on
GitHub.
Images are published to ghcr.io/rtvkiz/minimal-*.